Iris AI – AI Homepage, Chatbot & Site Assistant Security & Risk Analysis

The iris-ai v2.0.2 plugin exhibits a generally good security posture, with a significant majority of SQL queries using prepared statements and output properly escaped. The absence of known vulnerabilities in its history is a strong positive indicator of responsible development. However, the presence of unprotected AJAX handlers and REST API routes represents a notable weakness in the plugin's attack surface. Specifically, three entry points are unprotected, which could allow unauthenticated users to trigger actions or access data. While taint analysis did not reveal critical or high severity flows, the identified flows with unsanitized paths warrant attention, as they could potentially be exploited if combined with other misconfigurations or weaknesses. The plugin also makes external HTTP requests, which, while not inherently a vulnerability, could become one if the target endpoints are compromised or if the plugin does not properly validate or sanitize the responses.